Hacker News Reader

You don't need to receive a response to do damage with a request...

But you cannot send a POST request without preflight. Preflight is done with a separate request without your payload.